terni-ss[.]com

The domain terni-ss.com is currently classified as an active generic phishing site. It was registered on 28 April 2026 and remains operational as of the assessment date, 12 July 2026. Intelligence sources, including an AlienVault OTX pulse, have identified the domain in a single threat‑intel feed, confirming its malicious intent. Infrastructure analysis shows the domain is hosted behind a major content delivery network, with the IP address 172.67.150.205 located in Canada. The DNS resolution is delegated to three Chinese cloud provider DNS servers (ns1.huaweicloud-dns.cn, ns1.huaweicloud-dns.com, ns1.huaweicloud-dns.net). The TLS certificate is issued by a widely trusted certificate authority under the WE1 profile, indicating a valid TLS handshake despite the malicious purpose. Threat indicators reinforce the phishing classification. Malware scanning aggregators report that 2 of 95 scanned security tools flagged the domain, and a reputation engine assigns a trust score of 0 out of 100, the lowest possible rating. The site returns HTTP 403 for direct requests, suggesting that the content is hidden behind access controls, a common tactic to evade automated analysis. The domain appears on at least one public blocklist and is listed as blocked by an anti‑phishing organization, further evidencing its abusive nature. Defenders should immediately add terni-ss.com to outbound filtering rules and DNS‑based blocklists. Continuous monitoring of the associated IP address and the Chinese cloud provider DNS servers is advised, as the infrastructure could be reused for additional campaigns. Where feasible, sinkholing the domain or enforcing TLS inspection can provide visibility into any payloads served behind the 403 barrier. Regular re‑evaluation of the domain's reputation is recommended, given the low trust score and evolving threat landscape.